Google quietly attaches device phone numbers to all signed-in Android accounts
Updated Play Services policies verify SIM credentials on device setup and propagate the number to secondary and enterprise profiles without explicit prompts.
Technology news
Google has implemented a significant modification to its Android onboarding architecture, automatically verifying the active SIM card's telephone number during device setup and attaching it to every signed-in Google account on the hardware. Support documentation updates and Play services configuration changes confirm that secondary personal accounts, university profiles, and enterprise Google Workspace logins all inherit the verified device number without an explicit user authorization dialog.
The quiet rollout came to light after thousands of Android users received automated confirmation notices from Google stating their phone numbers had been verified for accounts they had never intended to tie to their cellular line. Google’s official support documentation indicates that universal number association is designed to facilitate account recovery, power cross-device Rich Communication Services (RCS) messaging, and drive 'Better sharing' capabilities like Quick Share and emergency location services. However, privacy researchers noted that linking cellular identifiers across separate identity partitions undermines account compartmentalization.
Furthermore, the automated verification mechanism covers both current and future accounts: adding a new Google account to an established phone immediately binds the existing phone number, while inserting a new physical SIM or activating an eSIM automatically links that number across every registered profile. Because carriers may charge SMS verification fees during background handshakes, the policy has drawn criticism from international users. The setting cannot be disabled globally from Google Account cloud dashboards and must be managed on each physical handset.
Our take: While unifying identity tokens improves communication reliability across Google’s RCS and security ecosystem, silently collapsing the boundary between personal, work, and secondary burner accounts represents an unacceptable privacy regression. Google must offer a granular opt-out toggle during initial device provisioning.